Skip to main content
emisar

AWS S3 operations

v0.1.11

Read-only S3 diagnostics for bounded bucket and object inventory, access, ownership, policy, logging, replication, lifecycle, encryption, versioning, and fixed object metadata. Object bodies and custom metadata values are excluded. Auth via AWS_PROFILE.

13 allowed by default
Pack ID
aws-s3
Vendor
emisar
OS
linux
Actions
13
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
aws jq

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install aws-s3 --hash sha256:e072730472cedfc95009d570a6df526eaf6b9629f6d96d63aa7355a5acc8469a

Setup

Drives the aws CLI on the runner host. It resolves credentials from its own environment or ~/.aws config — the runner only forwards the variables you allowlist in inherit_env .

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • AWS_PROFILE

    Named profile in ~/.aws/config and ~/.aws/credentials . Omit to use the default profile or static-key/instance-role auth.

  • AWS_REGION

    Default region for the CLI. S3 redirects per-bucket calls to the bucket's own region, so this is rarely required; set it to avoid an unset-region error on some setups.

  • AWS_ACCESS_KEY_ID

    Static access key. Use instead of a profile; pair with AWS_SECRET_ACCESS_KEY .

  • AWS_SECRET_ACCESS_KEY

    Secret for AWS_ACCESS_KEY_ID .

  • AWS_SESSION_TOKEN

    Session token for temporary (STS) credentials.

Notes

  • An EC2 instance role or ECS task role needs no key at all and is the shape to prefer; a static pair is minted from the IAM users console → the user → Security credentials → Create access key.
  • Read-only: the principal needs s3:ListAllMyBuckets, s3:ListBucket, s3:GetBucketLocation and the exact s3:GetBucket* / s3:GetObject permissions for the buckets you inspect.
  • Alternative to env keys: an ~/.aws/credentials profile (read from disk, no inherit_env entry) or, on EC2/ECS, the instance/task role from instance metadata (no credentials needed at all).
  • Object metadata is projected locally: custom metadata key names are returned, but their values and object bodies never leave the runner.
  • List actions return a next_page_cursor ; feed it back as page_cursor for explicit bounded pagination.
  • This remote-target pack declares no host detection signal and is never auto-suggested merely because aws is installed.

Verify it works

Runs s3.list_buckets, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify aws-s3

Install and configure a pack walks through the whole sequence on a host.

Actions 13 total

View on GitHub
  • s3.bucket_encryption exec low Low — read-only or trivially reversible

    aws s3api get-bucket-encryption

    Show default-encryption settings for one bucket.

    View source on GitHub
  • s3.bucket_lifecycle exec low Low — read-only or trivially reversible

    aws s3api get-bucket-lifecycle-configuration

    Show lifecycle rules (auto-expiry, glacier transition).

    View source on GitHub
  • s3.bucket_location exec low Low — read-only or trivially reversible

    aws s3api get-bucket-location

    Show the region for one bucket.

    View source on GitHub
  • s3.bucket_logging exec low Low — read-only or trivially reversible

    aws s3api get-bucket-logging

    Show one bucket's server access logging destination and grants.

    View source on GitHub
  • s3.bucket_ownership exec low Low — read-only or trivially reversible

    aws s3api get-bucket-ownership-controls

    Show one bucket's object ownership controls.

    View source on GitHub
  • s3.bucket_policy exec low Low — read-only or trivially reversible

    aws s3api get-bucket-policy

    Show bucket policy JSON.

    View source on GitHub
  • s3.bucket_policy_status exec low Low — read-only or trivially reversible

    aws s3api get-bucket-policy-status

    Show whether one bucket policy makes the bucket public.

    View source on GitHub
  • s3.bucket_public_access exec low Low — read-only or trivially reversible

    aws s3api get-public-access-block

    Show one bucket's public-access block controls.

    View source on GitHub
  • s3.bucket_replication exec low Low — read-only or trivially reversible

    aws s3api get-bucket-replication

    Show one bucket's replication role and rules.

    View source on GitHub
  • s3.bucket_versioning exec low Low — read-only or trivially reversible

    aws s3api get-bucket-versioning

    Show versioning state of one bucket.

    View source on GitHub
  • s3.list_buckets script low Low — read-only or trivially reversible

    aws s3api list-buckets

    List a bounded page of buckets the active AWS identity can access.

    View source on GitHub
  • s3.list_objects script low Low — read-only or trivially reversible

    aws s3api list-objects-v2

    List one bounded page of object system metadata under a literal prefix.

    View source on GitHub
  • s3.object_metadata script low Low — read-only or trivially reversible

    aws s3api head-object

    Show one object's system metadata and custom metadata keys without its body or custom values.

    View source on GitHub
← Back to registry
Pack reference  Publish your own